fix: give the container a trust store

The Proton Drive client verifies TLS against the system CAs, and
debian-slim ships none at all — no /etc/ssl/certs, no bundle — so every
request out of the container died at the handshake with "No CA
certificates were loaded from the system", before it could even be a
login. `webpki-roots` is compiled in, but choosing it happens inside the
SDK when it builds its HTTP client, so the image is the place to fix it.

Also answer `--help` before reading the configuration: a host that has
not been set up yet is exactly where that question gets asked, and it
was being met with "DIARY_USER must be set".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D5Gk8FPkRXu1e6Nj2BCRE1

src/main.rs

@@ -40,6 +40,16 @@ async fn main() -> Result<()> {
         .with(tracing_subscriber::fmt::layer())
         .init();
 
+    // Asked before anything is loaded: `--help` must answer on a host that has
+    // not been configured yet, which is exactly where it gets asked.
+    if matches!(
+        std::env::args().nth(1).as_deref(),
+        Some("help" | "--help" | "-h")
+    ) {
+        print!("{}", cli::USAGE);
+        return Ok(());
+    }
+
     let config = Config::from_env()?;
     tokio::fs::create_dir_all(config.uploads_dir())
         .await
@@ -64,10 +74,6 @@ async fn main() -> Result<()> {
             );
             return Ok(());
         }
-        Some("help" | "--help" | "-h") => {
-            print!("{}", cli::USAGE);
-            return Ok(());
-        }
         Some(other) => {
             anyhow::bail!("unknown command {other:?}\n\n{}", cli::USAGE);
         }